@volter/supercode-terminal 0.2.75 → 0.3.1

package/CAPABILITIES.md

@@ -23,7 +23,6 @@ means it must not be presented as supported.
 | Scrollback, selection and copy | UI/xterm | verified | Bounded scrollback and native xterm selection. |
 | Find in one terminal, next/previous match | UI | verified | Search covers the active xterm buffer. Cross-tab search is missing. |
 | URL detection | UI | partial | The stable xterm web-link provider is active; host policy and end-to-end link opening still need a dedicated proof. |
-| Exclusive input ownership | tmux/host | partial | `acquireInput`, `ownsInput` and `releaseInput` serialize a paste with other input and remain with the pane across a client restart. [Recorded tmux proof](../../docs/evidence/claude-input-2026-10-07.md#recorded-review-fixes) rejects a replacement while the badge is unrecorded, then confirms one native message after daemon restart. `PaneServerHost.createSession` can require this ABI before creating a pane; [manual old/current server admission](../../docs/evidence/launch-input-ownership-admission-2026-10-09.md) is recorded on macOS. Older pane servers refuse this door; Windows ownership restart and admission remain unmeasured. |
 | Paste and bracketed paste | UI | verified | Multiline or large pastes require confirmation; history is memory-only. Advanced transforms and slow paste are missing. |
 | Save terminal contents | UI | partial | The normal buffer is projected to a bounded plain-text download; the browser download boundary and continuous logging still need dedicated proof. |
 | Bell and background activity | UI | verified | A controlled tmux shell proved active visual bell plus inactive activity/bell tab state. System notifications are host policy. |

package/README.md

@@ -52,12 +52,6 @@ PTY host reads its own live catalog; an older pane server refuses this operation
 This is a host observation, not a physical window/tab reading or an existence
 lock against a subsequent launch.
 
-`PaneServerHost.createSession({ ..., requireInputOwnership: true })` requires
-the connected server's ownership operation before creating a pane. An older
-server rejects with `input_ownership_unsupported` and starts no process; the
-same connection handles admission and creation. Omitting the option preserves
-ordinary creation. [Manual old/current server SDK readings](../../docs/evidence/launch-input-ownership-admission-2026-10-09.md)
-do not qualify Windows or native harness first-message delivery.
 
 The substrate was moved from a retired package without behavioral changes.
 Its existing home paths, environment variables, and tmux ownership markers stay

package/index.d.ts

@@ -62,13 +62,11 @@ export class TmuxTerminalHost {
   sendInput(
     sessionId: string,
     data: string,
-    options?: { deadlineMs?: number; submitMode?: 'retry' | 'single' | 'none'; inputOwner?: string },
+    options?: { deadlineMs?: number; submitMode?: 'retry' | 'single' | 'none' },
   ): Promise<TerminalInputDelivery>;
   /** Persist an opaque application context association on a session owned by this host. */
-  /** Exclusive input ownership, retained by the pane host across client restart. */
-  acquireInput(sessionId: string, owner: string): Promise<boolean> | boolean;
-  ownsInput(sessionId: string, owner: string): Promise<boolean> | boolean;
-  releaseInput(sessionId: string, owner: string): Promise<boolean> | boolean;
+  /** Every pane this host controls takes its keyboard and keeps no pane-scoped option of supercode's; answers the panes it changed. */
+  openPanes(): Promise<string[]>;
   bindContext(sessionId: string, contextKey: string): Promise<TerminalSession>;
   issueAttachment(sessionId: string, options?: { mode?: 'observe' | 'control' }): TerminalAttachmentGrant;
   attachSocket(
@@ -91,14 +89,9 @@ export class PaneServerHost {
   listSessions(): Promise<TerminalSession[]>;
   /** Requires a compatible pane server; an unsupported operation rejects. */
   hasLiveContext(contextKey: string): Promise<boolean>;
-  /** Require the running pane server's ownership door before creating a pane. */
-  createSession(input: { command: TmuxCommand; contextKey?: string; cwd?: string; env?: Record<string, string>; name?: string; requireInputOwnership?: boolean }): Promise<TerminalSession>;
+  createSession(input: { command: TmuxCommand; contextKey?: string; cwd?: string; env?: Record<string, string>; name?: string }): Promise<TerminalSession>;
   capture(sessionId: string, options?: { lines?: number; preserveEscapes?: boolean }): Promise<string>;
-  sendInput(sessionId: string, data: string, options?: { deadlineMs?: number; submitMode?: 'retry' | 'single' | 'none'; inputOwner?: string }): Promise<TerminalInputDelivery>;
-  /** Exclusive input ownership, retained by the pane host across client restart. */
-  acquireInput(sessionId: string, owner: string): Promise<boolean> | boolean;
-  ownsInput(sessionId: string, owner: string): Promise<boolean> | boolean;
-  releaseInput(sessionId: string, owner: string): Promise<boolean> | boolean;
+  sendInput(sessionId: string, data: string, options?: { deadlineMs?: number; submitMode?: 'retry' | 'single' | 'none' }): Promise<TerminalInputDelivery>;
   bindContext(sessionId: string, contextKey: string): Promise<TerminalSession>;
   renameWindow(sessionId: string, title?: string | null): Promise<string>;
   issueAttachment(sessionId: string, options?: { mode?: 'observe' | 'control' }): Promise<TerminalAttachmentGrant>;
@@ -130,12 +123,8 @@ export class PtyTerminalHost {
   sendInput(
     sessionId: string,
     data: string,
-    options?: { deadlineMs?: number; submitMode?: 'retry' | 'single' | 'none'; inputOwner?: string },
+    options?: { deadlineMs?: number; submitMode?: 'retry' | 'single' | 'none' },
   ): Promise<TerminalInputDelivery>;
-  /** Exclusive input ownership, retained by the pane host across client restart. */
-  acquireInput(sessionId: string, owner: string): Promise<boolean> | boolean;
-  ownsInput(sessionId: string, owner: string): Promise<boolean> | boolean;
-  releaseInput(sessionId: string, owner: string): Promise<boolean> | boolean;
   bindContext(sessionId: string, contextKey: string): Promise<TerminalSession>;
   /** A ConPTY pane has no window to rename; returns its label. */
   renameWindow(sessionId: string, title?: string | null): string;
@@ -254,8 +243,6 @@ export class TerminalHostError extends Error {
  * it as "not ready yet".
  */
 export function composerReadyForInput(kind: string, screen: string | undefined): boolean | null;
-/** Does the composer hold a typed draft? `screen` is a capture with escapes; null when no composer is on screen. */
-export function composerHoldsDraft(kind: string, screen: string | undefined): boolean | null;
 
 export { classifyAttentionSignal, observeLifecycle, gatherLifecycleObservation, createLifecycleStore, snapshotProcessTree, snapshotProcessTreeAsync } from './substrate/session-lifecycle.js';
 export { HARNESS_MARKERS, HARNESS_CHILD_SESSION_MARKERS, isHarnessMarker, withoutHarnessMarkers, dropOwnHarnessMarkers } from './substrate/harness-env.js';
@@ -277,6 +264,5 @@ export type { TerminalInputDelivery, TmuxCommand, TmuxWindowSize };
 
 /** The bounded live composer text, or null for an unrecognized screen. */
 export function composerText(kind: string, screen: string | undefined): string | null;
-export function restoreComposerInput(host: TmuxTerminalHost | PtyTerminalHost | PaneServerHost, sessionId: string, kind: string, text: string, options?: { pasted?: string | null; inputOwner?: string }): Promise<{ restored: boolean; reason?: string; remaining?: string }>;
-/** Failed input is restored or returns an explicit cleanup obligation; never blindly resend. */
-export function deliverComposerInput(host: TmuxTerminalHost | PtyTerminalHost | PaneServerHost, sessionId: string, kind: string, text: string, options?: { deadlineMs?: number; signal?: AbortSignal }): Promise<{ delivered: boolean; reason?: string; restored?: boolean; cleanup_required?: boolean; cleanup_reason?: string; cleanup_remaining?: string; delivery?: TerminalInputDelivery }>;
+/** Paste and submit, whatever the composer holds. */
+export function deliverComposerInput(host: TmuxTerminalHost | PtyTerminalHost | PaneServerHost, sessionId: string, kind: string, text: string, options?: { deadlineMs?: number; signal?: AbortSignal }): Promise<{ delivered: boolean; reason?: string; path?: string; delivery?: TerminalInputDelivery }>;

package/index.mjs

@@ -16,7 +16,6 @@ import { openLocalTerminal as defaultOpenLocalTerminal } from './substrate/local
 const DEFAULT_ATTACHMENT_TTL_MS = 30_000;
 const DEFAULT_CONTEXT_OPTION = '@supercode-context';
 const DEFAULT_OWNER_OPTION = '@supercode-owner';
-const INPUT_OWNER_OPTION = '@supercode-input-owner';
 const SESSION_NAME = /^[A-Za-z0-9_-]{1,64}$/;
 // A pane should feel like the terminal it is shown in, not like tmux: no status
 // bar, no prefix key taking keystrokes from the program, and no mouse capture,
@@ -25,11 +24,14 @@ const SESSION_NAME = /^[A-Za-z0-9_-]{1,64}$/;
 // relay clients.) Session-scoped, so other sessions on the same tmux server
 // keep their own settings.
 const TERMINAL_LIKE_SESSION = Object.freeze({ status: 'off', mouse: 'off', prefix: 'None', prefix2: 'None', 'remain-on-exit': 'failed' });
-
-function inputOwner(value) {
-  if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/u.test(value)) throw new TypeError('An input owner must be an opaque token.');
-  return value;
-}
+// A pane session (p_*) keeps its pane after its program ends however it ended, a clean end included, until the
+// pane's end is in the pane-exit log: the record is written from the dead pane's own status, by the substrate's
+// pane-died hook or by this host (#sessionNames), whichever reads the pane first, and the pane is closed after it.
+// Only p_* sessions: they are the ones the hook and the host close.
+const PANE_SESSION = Object.freeze({ ...TERMINAL_LIKE_SESSION, 'remain-on-exit': 'on' });
+// What tmux draws in a dead pane (tmux 3.3 and later; before it the line is tmux's own and cannot be set): nothing
+// for a clean end, whose pane is about to close, and tmux's own default line for a failed one.
+const PANE_DEAD_LINE = '#{?#{&&:#{==:#{pane_dead_status},0},#{==:#{pane_dead_signal},}},,Pane is dead (#{?#{!=:#{pane_dead_status},},status #{pane_dead_status},}#{?#{!=:#{pane_dead_signal},},signal #{pane_dead_signal},}#, #{t:pane_dead_time})}';
 
 function runTmuxInput(socket, args, input = null) {
   return new Promise((resolve, reject) => {
@@ -173,6 +175,8 @@ export class TerminalWebSocketBridge {
 
 export class TmuxTerminalHost {
   #allowUnownedControl;
+  #answered = false;
+  #dead = new Map();
   #generation = 0;
   #listing = null;
   #attachments = new Map();
@@ -219,6 +223,12 @@ export class TmuxTerminalHost {
   /** Complete context observation for callers deciding whether a pane has ended. */
   hasLiveContext(contextKey) {
     assertContextKey(contextKey);
+    // A pane session whose program has ended is closed first, so tmux's answer is of the sessions something runs in.
+    // When the server answered and none is left, that is the complete reading: a server closing its last pane has
+    // no session to list and is not yet gone. A server that could not be read here is tmux's own reading below.
+    let names = null;
+    try { names = this.#sessionNames(); } catch { /* read below */ }
+    if (names && !names.length && this.#answered) return Promise.resolve(false);
     return this.#tmux.hasSessionContextAsync(this.#contextOption, contextKey, this.#socket);
   }
 
@@ -232,6 +242,9 @@ export class TmuxTerminalHost {
         this.#catalog.delete(id);
       }
     }
+    // No session, nothing more to ask: a server left with none is on its way out, and answers the readings below
+    // "no current target" until it is gone.
+    if (!names.length) return [];
     const panes = this.#panes();
     const [contextKeys, sizes] = await Promise.all([
       this.#tmux.sessionOptionValuesAsync(this.#contextOption, this.#socket),
@@ -242,7 +255,10 @@ export class TmuxTerminalHost {
       const id = this.#catalogId(name);
       const pane = panes.find((candidate) => candidate.session === name && candidate.window === 0 && candidate.pane === 0);
       const size = sizes.get(name);
+      const dead = this.#dead.get(name);
       return Object.freeze({
+        // a session of another name whose program failed: tmux keeps its pane for its last screen, and nothing runs in it
+        ...(dead ? { dead: true, exitCode: dead.exitCode } : {}),
         activeCommand: pane?.currentCommand ?? null,
         rootPid: pane?.rootPid ?? null,
         contextKey: contextKeys.get(name) ?? null,
@@ -281,7 +297,8 @@ export class TmuxTerminalHost {
       ownerOption: this.#ownerOption,
       panes: 1,
       sessionOptions: input.contextKey ? { [this.#contextOption]: input.contextKey } : {},
-      settings: TERMINAL_LIKE_SESSION,
+      settings: name.startsWith('p_') ? PANE_SESSION : TERMINAL_LIKE_SESSION,
+      optionalSettings: name.startsWith('p_') ? { 'remain-on-exit-format': PANE_DEAD_LINE } : {},
       socket: this.#socket,
     });
     // Raised once tmux has the session: a listing started before then cannot be the one that answers below.
@@ -319,8 +336,6 @@ export class TmuxTerminalHost {
     if (!this.#canControl(entry.name)) {
       throw new TerminalHostError('input_not_allowed', 'This host does not own that tmux session.');
     }
-    if (options.inputOwner) return this.#sendOwnedInput(entry.name, data, options);
-    if (await this.#inputOwned(entry.name)) throw new TerminalHostError('input_owned', 'This pane is confirming another input; no input was sent.');
     return await this.#tmux.sendInputAsync({
       data,
       deadlineMs: options.deadlineMs,
@@ -330,58 +345,6 @@ export class TmuxTerminalHost {
     });
   }
 
-  async #inputOwned(name, owner = null) {
-    const state = await runTmuxInput(this.#socket, ['display-message', '-p', '-t', `${name}:0.0`, `#{${INPUT_OWNER_OPTION}}:#{pane_input_off}`]);
-    return owner == null ? state.split(':')[0] !== '' : state === `${owner}:1`;
-  }
-
-  async acquireInput(sessionId, owner) {
-    inputOwner(owner);
-    const entry = this.#entry(sessionId);
-    if (!this.#canControl(entry.name)) throw new TerminalHostError('input_not_allowed', 'This host does not own that pane.');
-    if (await this.#inputOwned(entry.name, owner)) return true;
-    const target = `${entry.name}:0.0`;
-    const condition = `#{&&:#{==:#{${INPUT_OWNER_OPTION}},},#{==:#{pane_input_off},0}}`;
-    const command = `set-option -p -t ${target} ${INPUT_OWNER_OPTION} ${owner} ; select-pane -d -t ${target} ; display-message -p acquired`;
-    return await runTmuxInput(this.#socket, ['if-shell', '-F', '-t', target, condition, command, 'display-message -p busy']) === 'acquired';
-  }
-
-  ownsInput(sessionId, owner) { return this.#inputOwned(this.#entry(sessionId).name, inputOwner(owner)); }
-
-  async releaseInput(sessionId, owner) {
-    inputOwner(owner);
-    const target = `${this.#entry(sessionId).name}:0.0`;
-    const condition = `#{==:#{${INPUT_OWNER_OPTION}},${owner}}`;
-    const command = `set-option -pu -t ${target} ${INPUT_OWNER_OPTION} ; select-pane -e -t ${target} ; display-message -p released`;
-    return await runTmuxInput(this.#socket, ['if-shell', '-F', '-t', target, condition, command, 'display-message -p other']) === 'released';
-  }
-
-  async #sendOwnedInput(name, data, options) {
-    const owner = inputOwner(options.inputOwner), target = `${name}:0.0`;
-    const write = async command => {
-      if (options.deadlineMs != null && Date.now() >= options.deadlineMs) throw new TerminalHostError('input_expired', 'Terminal input expired before delivery.');
-      const condition = `#{&&:#{==:#{${INPUT_OWNER_OPTION}},${owner}},#{==:#{pane_input_off},1}}`;
-      // The command queue does not yield between enable, write and disable:
-      // attached clients cannot replace a paste while it waits for its badge.
-      const guarded = `select-pane -e -t ${target} ; ${command} ; select-pane -d -t ${target} ; display-message -p sent`;
-      if (await runTmuxInput(this.#socket, ['if-shell', '-F', '-t', target, condition, guarded, 'display-message -p other']) !== 'sent')
-        throw new TerminalHostError('input_owned', 'Input ownership changed; no input was sent.');
-    };
-    const submitted = defaultTmux.submittedTextFromInput(data);
-    if (submitted != null && submitted !== '') {
-      const buffer = `supercode-input-${randomUUID()}`;
-      await runTmuxInput(this.#socket, ['load-buffer', '-b', buffer, '-'], submitted);
-      try { await write(`paste-buffer -d -p -b ${buffer} -t ${target}`); }
-      finally { await runTmuxInput(this.#socket, ['delete-buffer', '-b', buffer]).catch(() => {}); }
-      if (options.submitMode !== 'none') { await sleep(SINGLE_SUBMIT_DELAY_MS); await write(`send-keys -t ${target} Enter`); }
-      return 'submitted-paste';
-    }
-    if (submitted === '' && options.submitMode === 'none') return 'submitted-line';
-    const bytes = Buffer.from(data.replace(/\n/gu, '\r'));
-    if (bytes.length) await write(`send-keys -H -t ${target} ${[...bytes].map(byte => byte.toString(16)).join(' ')}`);
-    return submitted === '' ? 'submitted-line' : 'keystream';
-  }
-
   async bindContext(sessionId, contextKey) {
     assertContextKey(contextKey);
     const entry = this.#entry(sessionId);
@@ -427,7 +390,6 @@ export class TmuxTerminalHost {
     const attachment = await attach({
       authorizeInput: async () => {
         if (grant.mode !== 'control') throw new TerminalHostError('input_not_allowed', 'This is a read-only terminal attachment.');
-        if (await this.#inputOwned(grant.name)) throw new TerminalHostError('input_owned', 'This pane is confirming another input; no input was sent.');
       },
       errorLabel: 'supercode',
       readOnly: grant.mode === 'observe',
@@ -476,6 +438,9 @@ export class TmuxTerminalHost {
       throw new TerminalHostError('close_not_allowed', 'This host does not own that tmux session.');
     }
     this.#tmux.killSessionProcessTree({ session: entry.name, socket: this.#socket });
+    // The close's own record: tmux's session-closed hook writes it too, but not when this session was the server's
+    // last (the server exits before the hook's run-shell has started).
+    if (entry.name.startsWith('p_') && !paneExitRecorded(entry.name)) recordPaneExit(entry.name, 0, null, null, hookStamp());
     this.#generation += 1;
     this.#catalog.delete(sessionId);
     this.#idByName.delete(entry.name);
@@ -484,6 +449,25 @@ export class TmuxTerminalHost {
     }
   }
 
+  /** Every pane this host controls takes its keyboard and keeps no pane-scoped option of supercode's (what supercode
+   *  keeps of a pane is its session's options). A daemon calls it once as it starts; answers the panes it changed. */
+  async openPanes() {
+    const changed = [];
+    for (const name of this.#sessionNames()) {
+      if (!this.#canControl(name)) continue;
+      const target = `${name}:0.0`;
+      try {
+        const off = await runTmuxInput(this.#socket, ['display-message', '-p', '-t', target, '#{pane_input_off}']) === '1';
+        const options = (await runTmuxInput(this.#socket, ['show-options', '-p', '-t', target])).split('\n')
+          .map((line) => line.split(' ')[0]).filter((key) => key.startsWith('@supercode-'));
+        if (off) await runTmuxInput(this.#socket, ['select-pane', '-e', '-t', target]);
+        for (const key of options) await runTmuxInput(this.#socket, ['set-option', '-pu', '-t', target, key]);
+        if (off || options.length) changed.push(name);
+      } catch { /* the pane ended meanwhile */ }
+    }
+    return changed;
+  }
+
   dispose() {
     for (const attachment of [...this.#liveAttachments]) attachment.dispose();
     this.#attachments.clear();
@@ -533,13 +517,43 @@ export class TmuxTerminalHost {
     }
   }
 
+  /**
+   * The sessions something runs in. A session whose pane's program has ended is still a session to tmux, kept by
+   * `remain-on-exit`; it is never answered as one here, to any caller (a listing, a liveness reading, an attachment,
+   * input, a close, a name's reuse). A pane session (p_*) in that state is finished off here as the pane-died hook
+   * would: its end written to the pane-exit log when no line names the pane yet (the screen with it when it failed),
+   * then the pane closed. So neither the record nor the pane's removal waits on a run-shell inside the server, which
+   * a server without `tmux` on its PATH cannot run. A session of another name is not this host's to close (tmux keeps
+   * its failed pane for its last screen): it stays listed, marked `dead` with its `exitCode`, as the ConPTY host
+   * marks one.
+   */
   #sessionNames() {
+    let states;
+    this.#answered = false;
     try {
-      return this.#tmux.listTmuxSessionNames(this.#socket);
+      states = this.#tmux.listSessionStates(this.#socket);
+      this.#answered = true;
     } catch (error) {
-      if (isEmptyServerError(error)) return [];
-      throw error;
+      if (!isEmptyServerError(error)) throw error;
+      states = [];
+    }
+    const names = [];
+    this.#dead.clear();
+    for (const state of states) {
+      if (!state.dead) names.push(state.name);
+      else if (!state.name.startsWith('p_')) { names.push(state.name); this.#dead.set(state.name, { exitCode: state.exitCode }); }
+      else {
+        if (!paneExitRecorded(state.name)) {
+          const failed = state.exitCode !== 0 || Boolean(state.signal);
+          let screen = null;
+          if (failed) { try { screen = this.#tmux.capturePane({ lines: 200, preserveEscapes: true, socket: this.#socket, target: state.paneId }); } catch { /* the pane is gone */ } }
+          recordPaneExit(state.name, state.exitCode, state.signal, screen, hookStamp());
+        }
+        this.#tmux.closeDeadPane({ paneId: state.paneId, session: state.name, socket: this.#socket });
+        this.#generation += 1;
+      }
     }
+    return names;
   }
 }
 
@@ -620,9 +634,23 @@ for (const event of ['end', 'close', 'error']) process.stdin.on(event, sweep);
  * signal=…` when it failed), under SUPERCODE_HOME or ~/.config/supercode: the machine daemon tells a clean finish from
  * a failure by it, and a ConPTY pane that ended cleanly is otherwise gone without a trace.
  */
-function recordPaneExit(contextKey, exitCode, signal, screen = null) {
+/** Whether the pane-exit log (either home's) holds a line of this pane's end. */
+function paneExitRecorded(pane) {
+  for (const root of new Set([process.env.SUPERCODE_HOME, join(homedir(), '.config', 'supercode')].filter(Boolean))) {
+    try { if (readFileSync(join(root, 'pane-exits.log'), 'utf8').split('\n').some((line) => line.endsWith(` ${pane} closed`) || line.includes(` ${pane} died `))) return true; }
+    catch { /* no log there */ }
+  }
+  return false;
+}
+
+/** Now as the tmux hooks stamp a line (`date +%FT%T`, the machine's own time): one log's lines are ordered by it. */
+function hookStamp() {
+  const now = new Date(), two = (value) => String(value).padStart(2, '0');
+  return `${now.getFullYear()}-${two(now.getMonth() + 1)}-${two(now.getDate())}T${two(now.getHours())}:${two(now.getMinutes())}:${two(now.getSeconds())}`;
+}
+
+function recordPaneExit(contextKey, exitCode, signal, screen = null, at = new Date().toISOString().slice(0, 19)) {
   if (!contextKey) return;
-  const at = new Date().toISOString().slice(0, 19);
   const line = exitCode === 0 && !signal ? `${at} ${contextKey} closed\n` : `${at} ${contextKey} died status=${exitCode ?? ''} signal=${signal || ''}\n`;
   try { appendFileSync(join(process.env.SUPERCODE_HOME || join(homedir(), '.config', 'supercode'), 'pane-exits.log'), line); } catch { /* no log is no worse than before */ }
   if ((exitCode !== 0 || signal) && typeof screen === 'string' && /^p_[A-Za-z0-9_-]+$/.test(contextKey)) {
@@ -769,12 +797,10 @@ export class PtyTerminalHost {
 
   async sendInput(sessionId, data, options = {}) {
     const entry = this.#live(sessionId);
-    if ((entry.inputOwner ?? null) !== (options.inputOwner ?? null)) throw new TerminalHostError('input_owned', 'This pane is confirming another input; no input was sent.');
     if (typeof data !== 'string') throw new Error('Input data must be a string.');
     const deadline = options.deadlineMs;
     const write = (bytes) => {
       if (deadline !== undefined && deadline - Date.now() <= 0) throw new Error('Terminal input expired before delivery.');
-      if ((entry.inputOwner ?? null) !== (options.inputOwner ?? null)) throw new TerminalHostError('input_owned', 'Input ownership changed; no input was sent.');
       this.#live(entry.id).child.write(bytes);
     };
     const submit = async () => {
@@ -799,18 +825,6 @@ export class PtyTerminalHost {
     return 'keystream';
   }
 
-  acquireInput(sessionId, owner) {
-    const entry = this.#live(sessionId); inputOwner(owner);
-    if (entry.inputOwner && entry.inputOwner !== owner) return false;
-    entry.inputOwner = owner; return true;
-  }
-  ownsInput(sessionId, owner) { return this.#live(sessionId).inputOwner === inputOwner(owner); }
-  releaseInput(sessionId, owner) {
-    const entry = this.#live(sessionId); inputOwner(owner);
-    if (entry.inputOwner !== owner) return false;
-    entry.inputOwner = null; return true;
-  }
-
   async bindContext(sessionId, contextKey) {
     assertContextKey(contextKey);
     this.#entry(sessionId).contextKey = contextKey;
@@ -886,7 +900,6 @@ export class PtyTerminalHost {
           socket.close(1008, 'terminal access ended');
           return;
         }
-        if (entry.inputOwner) throw new TerminalHostError('input_owned', 'This pane is confirming another input; no input was sent.');
         if (this.#sessions.has(entry.id) && !entry.exit) entry.child.write(message.data);
       } catch (error) {
         refuse(error);
@@ -1128,12 +1141,9 @@ export class PaneServerHost {
 
   listSessions() { return this.#request('listSessions', []); }
   hasLiveContext(contextKey) { assertContextKey(contextKey); return this.#request('hasLiveContext', [contextKey]); }
-  createSession(input) { return this.#request('createSession', [input], { requireInputOwnership: input.requireInputOwnership === true }); }
+  createSession(input) { return this.#request('createSession', [input]); }
   capture(sessionId, options = {}) { return this.#request('capture', [sessionId, options]); }
   sendInput(sessionId, data, options = {}) { return this.#request('sendInput', [sessionId, data, options]); }
-  acquireInput(sessionId, owner) { return this.#request('acquireInput', [sessionId, owner]); }
-  ownsInput(sessionId, owner) { return this.#request('ownsInput', [sessionId, owner]); }
-  releaseInput(sessionId, owner) { return this.#request('releaseInput', [sessionId, owner]); }
   closeSession(sessionId) { return this.#request('closeSession', [sessionId]); }
   renameWindow(sessionId, title) { return this.#request('renameWindow', [sessionId, title]); }
   issueAttachment(sessionId, options = {}) { return this.#request('issueAttachment', [sessionId, options]); }
@@ -1187,26 +1197,7 @@ export class PaneServerHost {
     for (let attempt = 0; ; attempt += 1) {
       const connection = await this.#connect();
       try {
-        if (op === 'createSession' && extra.requireInputOwnership) {
-          // The installed client can be newer than the server that still holds
-          // this machine's panes. Check its actual ownership door before any
-          // process starts, on the same connection that will create the pane.
-          // null cannot identify a PtyTerminalHost session: session_not_found
-          // means the vendor's ownership operation ran without touching a pane.
-          try {
-            await this.#call(connection, 'ownsInput', [null, 'capability_check']);
-            throw new TerminalHostError('input_ownership_unconfirmed', 'The pane server did not confirm its input ownership door; no pane was created.');
-          } catch (error) {
-            if (error?.code === 'unsupported') {
-              throw new TerminalHostError('input_ownership_unsupported', 'The running pane server does not support input ownership required for this first message; no pane was created. Update the pane server through its owner before retrying.');
-            }
-            if (error?.code !== 'session_not_found') throw error;
-          }
-          if (connection.destroyed || this.#connection !== connection) {
-            throw new TerminalHostError('pane_server_unreachable', 'The pane server connection changed during input ownership admission; no pane was created.');
-          }
-        }
-        return await this.#call(connection, op, args, { ...extra, requireInputOwnership: undefined });
+        return await this.#call(connection, op, args, extra);
       } catch (error) {
         if (error?.code !== 'pane_server_restarting' || attempt >= 20) throw error;
         await sleep(250);
@@ -1839,7 +1830,7 @@ function nativeAgentSessionId(harness, sessionId) {
 const COMPOSER_READY = Object.freeze({
   // codex's placeholder text IS the empty-composer state, which is exactly the
   // question here: not "is there a caret" but "is it waiting for a first
-  // message". A composer already holding a draft does not show it.
+  // message".
   codex: (screen) => screen.includes('› Ask Codex to do anything'),
   // Claude draws `❯`, or on Windows `>` and a no-break space (captured from a ConPTY pane on volter-desktop).
   'claude-code': (screen) => composerLine(screen, /^[❯>](?:\s|$)/u),
@@ -1887,52 +1878,11 @@ const ANSI_SEQUENCE = /\u001b\[[0-?]*[ -\/]*[@-~]|\u001b\][^\u0007\u001b]*(?:\u0
  */
 export function composerReadyForInput(kind, screen) {
   if (!Object.hasOwn(COMPOSER_READY, kind)) return null;
-  if (kind === 'claude-code' || kind === 'codex') return composerText(kind, screen) === '';
-  // gemini and grok: their composer is drawn, which is all a caret line says. A draft already typed in it is not
-  // read (no composerText for them), so for these two `true` means a composer present, not an empty one.
+  // `true` means a composer is drawn, whatever it holds.
+  if (kind === 'claude-code' || kind === 'codex') return composerText(kind, screen) !== null;
   return COMPOSER_READY[kind](String(screen ?? ''));
 }
 
-/**
- * Does the composer on this screen hold text the person typed (a draft)?
- * `screen` is a capture WITH escapes, because an empty composer may show a
- * placeholder, and only its styling (dim or grey) tells it from a draft.
- *
- *   true    the last composer line holds typed text
- *   false   the composer is on screen and empty (or shows only a placeholder)
- *   null    no composer is on screen (a menu, a dialog, a program still
- *           booting), or the kind has no composer pattern
- *
- * The caret is the kind's own, the one `composerReadyForInput` reads.
- */
-export function composerHoldsDraft(kind, screen) {
-  if (kind === 'claude-code' || kind === 'codex') {
-    const text = composerText(kind, screen);
-    return text === null ? null : text.length > 0;
-  }
-  const carets = COMPOSER_CARETS[kind];
-  if (!carets) return null;
-  const lines = String(screen ?? '').split('\n');
-  for (let index = lines.length - 1; index >= 0; index -= 1) {
-    const cells = styledCells(lines[index]);
-    const text = cells.map((cell) => cell.char).join('');
-    const start = text.length - text.trimStart().length;
-    const caret = carets.find((candidate) => text.trimStart().startsWith(candidate));
-    if (!caret) continue;
-    const typed = cells
-      .slice(start + caret.length)
-      .filter((cell) => !cell.placeholder)
-      .map((cell) => cell.char)
-      .join('')
-      .trim();
-    if (kind === 'codex' && typed.startsWith('Ask Codex to do anything')) return false;
-    // Claude's own suggestion (`Try "fix typecheck errors"`), when the capture carries no styling to mark it dim.
-    if (kind === 'claude-code' && /^Try ".*"$/u.test(typed)) return false;
-    return typed.length > 0;
-  }
-  return null;
-}
-
 /** Read only a bounded, live Claude/Codex composer, never a prompt in scrollback.
  * Unknown layouts and collapsed pastes are deliberately unconfirmed.
  */
@@ -1945,8 +1895,7 @@ export function composerText(kind, screen) {
   // Codex's status row is `model · cwd` plus whatever else it has to say (a goal's state, a warning count). On a row
   // too narrow for all of it Codex cuts the cwd down to its ellipsis (`· … Goal stalled (/goal resume)`, `· ~… Goal
   // paused (/goal resume)`, both read from 80-column panes on yuerans, 2026-10-10), and a row whose cwd was required
-  // to open with a path root read as no footer: the idle composer above it read as absent and the session's mail
-  // waited as `no-composer` until it expired.
+  // to open with a path root read as no footer: the idle composer above it read as absent.
   const footer = /^\s*(?:.*\btab to queue (?:a )?message\b.*$|\? for shortcuts\b|⚠\s+\d+\s+warnings?\s+·\s+f2 to view\s*$|[^\n]+ · (?:~?…|~(?:[\\/]|(?=\s|$))|[\\/]|[A-Z]:[\\/])[^\n]*$|.*← for agents\s*$|.*\bcontext(?:\s+\d+%)?\s+left\b)/iu;
   const caret = kind === 'codex' ? /^\s*›(?:\s|$)/u : /^\s*[❯>](?:\s|$)/u;
   for (let row = plain.length - 1; row >= 0; row -= 1) {
@@ -1974,158 +1923,31 @@ export function composerText(kind, screen) {
   return null;
 }
 
-/** Match screen rows against the original text. A visual row boundary can be
- * a hard newline, a word wrap (one space), or a wrap inside a word. Never erase
- * whitespace within rows: a changed or partially pasted draft stays unconfirmed.
- */
-function composerMatches(value, wanted) {
-  if (value === null) return false;
-  let offsets = new Set([0]);
-  const rows = value.split('\n');
-  for (let row = 0; row < rows.length; row += 1) {
-    const next = new Set();
-    for (const offset of offsets) {
-      if (!wanted.startsWith(rows[row], offset)) continue;
-      const end = offset + rows[row].length;
-      if (row === rows.length - 1) next.add(end);
-      else {
-        next.add(end);
-        if (wanted[end] === ' ' || wanted[end] === '\n') next.add(end + 1);
-      }
-    }
-    offsets = next;
-  }
-  return offsets.has(wanted.length);
-}
-
-/** Claude collapses a long single-line paste to `[Pasted text #N]` and a multi-line paste to
- * `[Pasted text #N +K lines]`. The placeholder (as shown) when it can stand for `text`: K is the pasted text's line breaks (the
- * trimmed text's, or the sent payload's with its closing newline). Which paste it is, #N, only the paste itself
- * tells: a caller holds the placeholder its own paste produced and accepts no other. */
-function pastePlaceholder(composer, text) {
-  const shown=String(composer??'').trim();
-  const placeholder=/^\[Pasted text #\d+(?: \+(\d+) lines?)?\]$/u.exec(shown);
-  if(!placeholder)return null;
-  const breaks=value=>(value.match(/\n/gu)??[]).length;
-  return (placeholder[1]===undefined?breaks(String(text).trim())===0:
-    [breaks(String(text).trim()),breaks(`${text}\n`)].includes(Number(placeholder[1])))?shown:null;
-}
-
-/** Undo only text this input wrote, including when a turn started meanwhile.
- * Never Enter, Escape, or Ctrl-C: restoration must not submit or stop work.
- * `pasted`: the `[Pasted text #N …]` placeholder this input's own paste produced. Only that one is cleared: another
- * of the same size is a person's own paste. */
-export async function restoreComposerInput(host, sessionId, kind, text, { pasted = null, inputOwner: owner = null } = {}) {
-  const read=async()=>composerText(kind,await host.capture(sessionId,{preserveEscapes:true}));
-  let remaining=await read();
-  if(remaining==='')return {restored:true};
-  if(!composerMatches(remaining,String(text).trim())&&!(pasted&&remaining.trim()===pasted))return {restored:false,reason:'composer-changed-or-unreadable'};
-  const lines=remaining.split('\n').length+2;
-  for(let line=0;line<lines;line++) {
-    if(await read()!==remaining)return {restored:false,reason:'composer-changed',remaining};
-    await host.sendInput(sessionId,'\u0005\u0015',{submitMode:'none',...(owner ? { inputOwner: owner } : {})});
-    await sleep(100);
-    let after=await read();
-    if(after==='')return {restored:true};
-    if(after===null||!remaining.includes(after))return {restored:false,reason:'composer-changed',remaining};
-    remaining=after;
-    if(await read()!==remaining)return {restored:false,reason:'composer-changed',remaining};
-    await host.sendInput(sessionId,'\u007f',{submitMode:'none',...(owner ? { inputOwner: owner } : {})});
-    await sleep(100);after=await read();
-    if(after==='')return {restored:true};
-    if(after===null||!remaining.replace(/\n/g,'').includes(after.replace(/\n/g,'')))return {restored:false,reason:'composer-changed',remaining};
-    remaining=after;
-  }
-  return {restored:false,reason:'restore-unconfirmed',remaining};
-}
-
-/** Paste only into a stable idle composer. A failed paste is restored; an
- * unreadable/concurrently changed composer returns an explicit repair obligation. */
+/** Paste `text` into the pane's composer and submit it, whatever the composer holds. The composer is read afterwards
+ * only to see the paste leave it: an Enter that arrived before the paste was drawn is pressed again. */
 export async function deliverComposerInput(host, sessionId, kind, text, { deadlineMs = Date.now() + 10_000, signal } = {}) {
-  if (kind !== 'claude-code') return deliverOwnedComposerInput(host, sessionId, kind, text, { deadlineMs, signal });
-  const owner = randomUUID();
+  const read = async () => composerText(kind, await host.capture(sessionId, { preserveEscapes: true }));
+  const expired = () => signal?.aborted || Date.now() >= deadlineMs;
+  if (!String(text).trim() || /[\x00-\x08\x0b-\x1f\x7f]/u.test(text)) return { delivered: false, reason: 'unsupported-text' };
+  if (expired()) return { delivered: false, reason: 'deadline' };
   try {
-    if (!host.acquireInput || !await host.acquireInput(sessionId, owner)) return { delivered: false, reason: 'input-ownership-unavailable; no input pasted' };
-    return await deliverOwnedComposerInput(host, sessionId, kind, text, { deadlineMs, signal, owner });
-  } catch (error) { return { delivered: false, reason: error?.message ?? String(error) }; }
-  finally { await Promise.resolve(host.releaseInput?.(sessionId, owner)).catch(() => {}); }
-}
-
-async function deliverOwnedComposerInput(host, sessionId, kind, text, { deadlineMs, signal, owner = null }) {
-  const capture=async()=>{
-    if (owner && !await host.ownsInput(sessionId, owner)) throw new TerminalHostError('input_owned', 'Input ownership changed; the composer is preserved.');
-    return host.capture(sessionId,{preserveEscapes:true});
-  };
-  const inputOptions = owner ? { inputOwner: owner } : {};
-  const read=async()=>composerText(kind,await capture());
-  const expired=()=>signal?.aborted||Date.now()>=deadlineMs;
-  let touched=false;
-  // The placeholder this paste produced: the first one seen after pasting into a composer read empty twice. From then
-  // on only that one (its #N) is this text, and only that one is restored away.
-  let pasted=null;
-  const failed=async (reason, evidence={})=>{
-    if(!touched)return {delivered:false,reason,...evidence};
-    let restored;
-    try{restored=await restoreComposerInput(host,sessionId,kind,text,{pasted,...inputOptions});}catch(error){restored={restored:false,reason:error.message};}
-    return {delivered:false,reason,...evidence,restored:restored.restored,cleanup_required:!restored.restored,cleanup_reason:restored.reason,cleanup_remaining:restored.remaining};
-  };
-  if(expired())return failed('deadline');
-  const wanted=String(text).trim();
-  const holds=composer=>{
-    if(composerMatches(composer,wanted))return true;
-    const placeholder=pastePlaceholder(composer,text);
-    if(placeholder&&touched&&pasted===null)pasted=placeholder;
-    return placeholder!==null&&placeholder===pasted;
-  };
-  if(!wanted||/[\x00-\x08\x0b-\x1f\x7f]/u.test(text))return failed('unsupported-text');
-  for(let check=0;check<2;check++) {
-    const screen=await capture(),before=composerText(kind,screen);
-    if(before!=='')return failed(before===null?'no-composer':'draft');
-    if(check===0)await sleep(200);
-  }
-  if(expired())return failed('deadline');
-  try {
-    touched=true;
-    const delivery=await host.sendInput(sessionId,`${text}\n`,{submitMode:'none',deadlineMs,...inputOptions});
-    let pasteVisible=false;
-    while(!expired()) {
-      await sleep(100);
-      if(holds(await read())){pasteVisible=true;break;}
-    }
-    // A final paint at the deadline still belongs to this paste. Submit it
-    // once; its caller must confirm the native user-message receipt.
-    if(expired()) {
-      if(!signal?.aborted&&holds(await read())) {
-        await host.sendInput(sessionId,'\r',{submitMode:'single',deadlineMs:Date.now()+1000,...inputOptions});
-        return {delivered:false,reason:'native-transcript-confirmation-required',delivery};
-      }
-      return failed('paste-unconfirmed');
-    }
-    if(!pasteVisible)return failed('paste-unconfirmed');
-    for(let attempt=0;attempt<3;attempt++) {
-      if(expired())return failed('deadline');
-      const screen=await capture();
-      if(!holds(composerText(kind,screen)))return failed('composer-changed');
-      if(expired())return failed('deadline');
-      await host.sendInput(sessionId,'\r',{submitMode:'single',deadlineMs,...inputOptions});
-      for(let poll=0;poll<10&&!expired();poll++) {
+    const before = await read();
+    const delivery = await host.sendInput(sessionId, `${text}\n`, { submitMode: 'none', deadlineMs });
+    // the paste is drawn a moment after it is written: Enter follows its first sighting, or a second without one
+    for (let poll = 0; poll < 10 && !expired() && await read() === before; poll++) await sleep(100);
+    for (let attempt = 0; attempt < 3 && !expired(); attempt++) {
+      await host.sendInput(sessionId, '\r', { submitMode: 'single', deadlineMs });
+      for (let poll = 0; poll < 10 && !expired(); poll++) {
         await sleep(100);
-        const current=await read();
-        // This helper reports its transport submit to the standalone terminal
-        // controller. Teams-owned Claude panes use the retained native-receipt
-        // queue; changing this SDK result would mark every controller launch
-        // failed even when its input was submitted.
-        if(current==='')return kind === 'claude-code' ? {delivered:true,delivery,path:'composer_submit'} : {delivered:false,reason:'native-transcript-confirmation-required',delivery};
-        if(!holds(current))return failed('submission-unconfirmed');
+        // This helper reports its transport submit to the standalone terminal controller. Teams panes use the
+        // retained native-receipt queue, which confirms from the native transcript.
+        if (!await read()) return kind === 'claude-code' ? { delivered: true, delivery, path: 'composer_submit' } : { delivered: false, reason: 'native-transcript-confirmation-required', delivery };
       }
     }
-    return failed('submit-unconfirmed');
-  }catch(error){return failed(error?.message??String(error));}
+    return { delivered: false, reason: expired() ? 'deadline' : 'submit-unconfirmed', delivery };
+  } catch (error) { return { delivered: false, reason: error?.message ?? String(error) }; }
 }
 
-/** The carets each kind draws at the start of its composer line (Claude on Windows draws `>`). */
-const COMPOSER_CARETS = Object.freeze({ 'claude-code': ['❯', '>'], codex: ['›'], gemini: ['>'], grok: ['❯'] });
-
 /**
  * The visible characters of one captured line, each marked as placeholder
  * styling (dim, bright black, or a grey foreground) or not. Only SGR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-terminal",
-  "version": "0.2.75",
+  "version": "0.3.1",
   "type": "module",
   "description": "Optional leak-safe terminal and tmux host adapter for Volter Harness frontends",
   "exports": {

package/substrate/pane-server.mjs

@@ -32,7 +32,7 @@ function leave() {
   setTimeout(() => { server.close(); for (const connection of clients) connection.end(); setTimeout(done, 500); }, 3_000).unref?.();
 }
 
-const OPS = new Set(['listSessions', 'hasLiveContext', 'createSession', 'capture', 'sendInput', 'acquireInput', 'ownsInput', 'releaseInput', 'closeSession', 'renameWindow', 'issueAttachment', 'bindContext']);
+const OPS = new Set(['listSessions', 'hasLiveContext', 'createSession', 'capture', 'sendInput', 'closeSession', 'renameWindow', 'issueAttachment', 'bindContext']);
 
 function scheduleIdleExit() {
   clearTimeout(idleTimer);

package/substrate/tmux.d.ts

@@ -25,12 +25,13 @@ export type CreateSessionOptions = {
     panes: number;
     sessionOptions?: Record<string, string>;
     settings?: Record<string, string>;
+    optionalSettings?: Record<string, string>;
     socket?: string;
 };
 export declare function assertTmux(): void;
 export declare function targetForSession(sessionName: string): string;
 export declare function assertSession(name: string, socket?: string): void;
-export declare function createSession({ command, cwd, env, name, owner, ownerOption: ownershipOption, panes, sessionOptions, settings, socket }: CreateSessionOptions): Promise<{
+export declare function createSession({ command, cwd, env, name, owner, ownerOption: ownershipOption, panes, sessionOptions, settings, optionalSettings, socket }: CreateSessionOptions): Promise<{
     name: string;
     panes: number;
 }>;
@@ -49,6 +50,33 @@ export declare function killSessionProcessTree({ session, socket }: {
     socket?: string;
 }): void;
 export declare function listTmuxSessionNames(socket?: string): string[];
+export type TmuxSessionState = {
+    name: string;
+    /** The id (`%N`) of the session's pane. */
+    paneId: string;
+    /** Whether the pane's program has ended and tmux keeps the pane (`remain-on-exit`). */
+    dead: boolean;
+    /** The ended program's exit status, when it exited; null when a signal ended it or tmux does not say. */
+    exitCode: number | null;
+    /** The signal that ended the program, as tmux names it; empty when it exited. */
+    signal: string;
+};
+/**
+ * Every session with whether its pane's program has ended, in one tmux process. A session whose pane is dead is
+ * still a session to tmux (`list-sessions` names it, `has-session` finds it) though nothing runs in it: a caller
+ * that asks only for names takes it for a live one. Throws as `listTmuxSessionNames` does when there is no server.
+ */
+export declare function listSessionStates(socket?: string): TmuxSessionState[];
+/**
+ * Closes one dead pane, and only it: the kill is tmux's own decision, in the server, on the pane being dead and
+ * still in the named session, so a pane id that another session has since been given (a server that restarted) or a
+ * session started again under the same name is never closed. Answers nothing; a pane already gone is the same end.
+ */
+export declare function closeDeadPane({ paneId, session, socket }: {
+    paneId: string;
+    session: string;
+    socket?: string;
+}): void;
 export declare function selectOrphanSessions({ allSessions, ownedSessions, prefix }: {
     allSessions: string[];
     ownedSessions: Iterable<string>;

package/substrate/tmux.js

@@ -41,7 +41,7 @@ export function assertSession(name, socket) {
 // createWindowSession), so every tmux invocation here uses runAsync (spawn, not
 // spawnSync) and the pane-ready poll below uses sleepAsync — see waitForPanesReady.
 // Nothing in this function may block the loop.
-export async function createSession({ command, cwd, env, name, owner, ownerOption: ownershipOption = ownerOption, panes, sessionOptions = {}, settings = {}, socket }) {
+export async function createSession({ command, cwd, env, name, owner, ownerOption: ownershipOption = ownerOption, panes, sessionOptions = {}, settings = {}, optionalSettings = {}, socket }) {
     assertTmux();
     if (!name) {
         throw new Error("--name is required.");
@@ -98,12 +98,12 @@ export async function createSession({ command, cwd, env, name, owner, ownerOptio
         // session with it before `remain-on-exit` or the owner stamp is set, and
         // the next set-option's "no such session" replaces the program's own
         // failure in what the launcher reports.
-        const setOnCreate = (option, value) => {
+        const setOnCreate = (option, value, quiet = false) => {
             assertOptionValue(value);
             // tmux splits commands at an argument that ends in `;`.
             if (value.endsWith(";"))
                 throw new Error(`A tmux option value set at creation cannot end in ";": ${option}`);
-            startArgs.push(";", "set-option", "-t", name, option, value);
+            startArgs.push(";", "set-option", ...(quiet ? ["-q"] : []), "-t", name, option, value);
         };
         if (owner)
             setOnCreate(ownershipOption, owner);
@@ -115,6 +115,10 @@ export async function createSession({ command, cwd, env, name, owner, ownerOptio
             assertSettingName(option);
             setOnCreate(option, value);
         }
+        for (const [option, value] of Object.entries(optionalSettings).sort(([left], [right]) => left.localeCompare(right))) {
+            assertSettingName(option);
+            setOnCreate(option, value, true);
+        }
         await runTmuxSessionCreateAsync(startArgs, { cwd, operation: "create tmux session", session: name, socket });
         await declareSessionColorEnvironmentAsync(socket);
         const target = targetForSession(name);
@@ -329,6 +333,34 @@ export function killSessionProcessTree({ session, socket }) {
 export function listTmuxSessionNames(socket) {
     return run("tmux", tmuxArgs(socket, ["list-sessions", "-F", "#{session_name}"])).split("\n").map((line) => line.trim()).filter(Boolean);
 }
+// The name last: tmux guarantees a session name holds no colon, and the fields before it never do.
+const sessionStateFormat = "#{pane_id}:#{pane_dead}:#{pane_dead_status}:#{pane_dead_signal}:#{session_name}";
+/**
+ * Every session with whether its pane's program has ended, in one tmux process. A session whose pane is dead is
+ * still a session to tmux (`list-sessions` names it, `has-session` finds it) though nothing runs in it: a caller
+ * that asks only for names takes it for a live one. Throws as `listTmuxSessionNames` does when there is no server.
+ */
+export function listSessionStates(socket) {
+    return run("tmux", tmuxArgs(socket, ["list-sessions", "-F", sessionStateFormat])).split("\n").filter((line) => line.trim()).map((line) => {
+        const [paneId = "", dead = "", status = "", signal = "", ...name] = line.split(":");
+        return { name: name.join(":"), paneId, dead: dead === "1", exitCode: /^\d+$/.test(status) ? Number(status) : null, signal };
+    });
+}
+/**
+ * Closes one dead pane, and only it: the kill is tmux's own decision, in the server, on the pane being dead and
+ * still in the named session, so a pane id that another session has since been given (a server that restarted) or a
+ * session started again under the same name is never closed. Answers nothing; a pane already gone is the same end.
+ */
+export function closeDeadPane({ paneId, session, socket }) {
+    if (!/^%\d+$/.test(paneId) || !/^[A-Za-z0-9_-]+$/.test(session))
+        return;
+    try {
+        run("tmux", tmuxArgs(socket, ["if-shell", "-F", "-t", paneId, `#{&&:#{pane_dead},#{==:#{session_name},${session}}}`, `kill-pane -t ${paneId}`]));
+    }
+    catch {
+        // the pane is gone already
+    }
+}
 // A session belongs to a provider's prefix iff it is the bare `prefix` or a
 // `prefix-*` child. The exact `-` boundary is load-bearing: prefix `worker` must
 // not claim `worker-pool-1`. The single home for that rule.
@@ -380,8 +412,17 @@ async function declareSessionColorEnvironmentAsync(socket) {
 // runs in the same invocation — `run` uses spawnSync without a shell, so the `;`
 // reaches tmux as a literal command separator, not a shell metacharacter.
 // A supercode pane (p_*) that ends leaves one line in the pane-exit log: its exit
-// status or signal when it failed (the session keeps a failed pane just long
-// enough for tmux to report it, then closes it), `closed` when it ended cleanly.
+// status or signal when it failed, `closed` when it ended cleanly. The pane-died
+// hook writes it from the dead pane's own status while the session still holds
+// the pane (its host creates p_* sessions with `remain-on-exit on`), and only then
+// closes the pane: a record written after the session is gone is lost when that
+// session was the server's last, because a server with no session exits
+// (`exit-empty`) before a hook's run-shell has started. The session-closed hook
+// writes `closed` for a session closed from outside, where no pane dies; the
+// host writes that line itself for the closes it performs.
+// The hook reads the pane's state in one `display`, so the status and the signal
+// are of one moment: a pane that is gone or not dead by then leaves no line.
+// Its screen is kept only when it failed, and only from a capture that worked.
 // The pane-died hook acts on the pane that died, named by `#{hook_pane}`, and on
 // nothing else: when its session is already gone (a close kills the session, then
 // its processes), tmux resolves an untargeted `kill-pane` and `#{session_name}` to
@@ -389,8 +430,8 @@ async function declareSessionColorEnvironmentAsync(socket) {
 // Targets are not expanded as formats, so the shell that run-shell starts resolves
 // the pane and does nothing when it no longer belongs to a p_* session.
 const PANE_EXIT_LOG = '"${SUPERCODE_HOME:-$HOME/.config/supercode}/pane-exits.log"';
-const PANE_EXIT_CAPTURE = 'case "$s" in *[!a-zA-Z0-9_-]*) exit 0 ;; esac; d="${SUPERCODE_HOME:-$HOME/.config/supercode}/pane-exits"; umask 077; mkdir -p "$d"; t capture-pane -p -e -S -200 -t "$p" 2>/dev/null | tail -c 32768 > "$d/$s.screen"';
-const PANE_DIED_HOOK = "run-shell 'p=\"#{hook_pane}\"; t() { tmux -S \"#{socket_path}\" \"$@\"; }; s=$(t display -p -t \"$p\" \"##{session_name}\" 2>/dev/null) || exit 0; case \"$s\" in p_*) ;; *) exit 0 ;; esac; printf \"%s %s died status=%s signal=%s\\n\" \"$(date +%FT%T)\" \"$s\" \"$(t display -p -t \"$p\" \"##{pane_dead_status}\")\" \"$(t display -p -t \"$p\" \"##{pane_dead_signal}\")\" >> " + PANE_EXIT_LOG + "; " + PANE_EXIT_CAPTURE + "; t kill-pane -t \"$p\"'";
+const PANE_EXIT_CAPTURE = 'case "$s" in *[!a-zA-Z0-9_-]*) exit 0 ;; esac; d="${SUPERCODE_HOME:-$HOME/.config/supercode}/pane-exits"; umask 077; mkdir -p "$d"; if t capture-pane -p -e -S -200 -t "$p" > "$d/$s.screen.part" 2>/dev/null; then tail -c 32768 "$d/$s.screen.part" > "$d/$s.screen"; fi; rm -f "$d/$s.screen.part"';
+const PANE_DIED_HOOK = "run-shell 'p=\"#{hook_pane}\"; t() { tmux -S \"#{socket_path}\" \"$@\"; }; r=$(t display -p -t \"$p\" \"##{pane_dead}|##{pane_dead_status}|##{pane_dead_signal}|##{session_name}\" 2>/dev/null) || exit 0; case \"$r\" in 1\\|*) ;; *) exit 0 ;; esac; st=$(printf %s \"$r\" | cut -d\"|\" -f2); sg=$(printf %s \"$r\" | cut -d\"|\" -f3); s=$(printf %s \"$r\" | cut -d\"|\" -f4-); case \"$s\" in p_*) ;; *) exit 0 ;; esac; if [ \"$st\" = 0 ] && [ -z \"$sg\" ]; then printf \"%s %s closed\\n\" \"$(date +%FT%T)\" \"$s\" >> " + PANE_EXIT_LOG + "; else printf \"%s %s died status=%s signal=%s\\n\" \"$(date +%FT%T)\" \"$s\" \"$st\" \"$sg\" >> " + PANE_EXIT_LOG + "; (" + PANE_EXIT_CAPTURE + "); fi; t kill-pane -t \"$p\"'";
 const SESSION_CLOSED_HOOK = "if-shell -F '#{m:p_*,#{hook_session_name}}' { run-shell 'printf \"%s %s closed\\n\" \"$(date +%FT%T)\" \"#{hook_session_name}\" >> " + PANE_EXIT_LOG + "' }";
 function sessionServerOptionArgs() {
     return [
@@ -510,8 +551,10 @@ export async function waitForPanesReady({ expectedPanes, socket, target, timeout
     const startedAt = Date.now();
     while (Date.now() - startedAt < timeoutMs) {
         const panes = await inspectPanesAsync(target, socket);
+        // A pane whose program has already ended is not waited for: it will not become ready, and its end is its
+        // caller's answer.
         const ready = panes.length === expectedPanes
-            && panes.every((pane) => pane.dead === false && pane.id);
+            && panes.every((pane) => pane.id);
         if (ready) {
             return panes;
         }